Is the CC a good first certification?

Yes. It is the most accessible recognised security credential, it carries the ISC2 name, and it costs little or nothing to attempt. It will not replace Security+ where an employer specifies that, but it is a strong first line on a CV.

ISC2 has offered the training and a first exam attempt free under its One Million Certified in Cybersecurity programme; check the current terms. Holders pay an annual maintenance fee.

Approachable. It is definitional and conceptual, with no simulations. Three to six weeks of part-time study is typical.

CC to start from zero at low cost; Security+ when a job advert or a compliance framework names it. Many people take CC first and Security+ within the year.

How long is it valid?

Three years, maintained with continuing professional education credits and the annual fee.

All certifications

ISC2 · CC · Entry

ISC2 Certified in Cybersecurity

ISC2's entry credential for people starting a security career: principles, access control, network security and operations.

Free practice: 214 questions written to the official exam guide, with the diagnostic, practice papers, timed mocks, a study plan and an explanation on every answer.

Official exam page

Find out where you stand on CC

20 questions drawn in the exam’s own domain weights. You get a report straight away: your score against the pass mark, where the points went, and what to study first.

Questions: 20
Time: about 20 minutes
Cost: free

Your email

Your answers save as you go, and the report stays in your record. A new email needs no code.

· your answers stay on this device and you can save the report at the end.

The course

The diagnostic shows where you stand. Then you learn the syllabus chapter by chapter, answer that chapter’s questions, and move on. When every chapter is mastered, you sit full timed mocks in the real exam’s shape.

15 chapters, about 11.5 hours in all. Each is a 45-minute study session with quick checks, then a 10-question quiz on that chapter.

Security Principles24% of the exam

Core cybersecurity concepts45 min
Risk management and security controls45 min
Governance concepts and professional ethics45 min

Security Governance17% of the exam

Governance, risk and compliance, and measuring effectiveness45 min
Business continuity and disaster recovery45 min
Security awareness and culture45 min

Identity and Access Management20% of the exam

Identity life cycle management45 min
Logical access controls45 min

Networking and Cloud Security21% of the exam

Network security fundamentals45 min
Network security architecture45 min
Cloud security45 min

Security Operations and Incident Response18% of the exam

Data security and encryption45 min
Security operations45 min
Incident response and asset protection45 min
Security testing45 min

About the ISC2 Certified in Cybersecurity (CC) exam

The ISC2 Certified in Cybersecurity is the entry-level credential from the organisation behind the CISSP. It was created for people with no security experience at all: students, career changers, IT staff moving into security, and anyone who wants a recognised foundation before a specialised certification. It requires no work experience and no prerequisites.

The outline that took effect on 1 September 2026 has five domains: security principles (the largest, at 24%), security governance, identity and access management, networking and cloud security, and security operations and incident response. The questions are conceptual rather than technical, and there are no simulations.

ISC2 has run a large free-training and free-first-exam programme for this certification since 2022; the annual maintenance fee applies once you hold it. Most candidates prepare in three to six weeks.

The exam at a glance

Questions: 100 to 125 questions, computerised adaptive testing (the outline effective 1 September 2026)
Time: 120 minutes
Pass mark: 700 out of 1,000
Exam fee: About US$199; ISC2 has offered the training and a first exam attempt free under its One Million Certified in Cybersecurity programme. An annual maintenance fee applies to holders
Valid for: 3 years, with continuing professional education credits and the annual fee
Where you sit it: Pearson VUE test centre
Prerequisites: None

As published in the vendor’s exam guide at the time of writing. Fees vary by country and change; the vendor’s page is the source of truth.

What is on the exam, domain by domain

Security Principles
The largest domain. Confidentiality, integrity and availability, authentication, authorisation and accounting, non-repudiation and privacy; the risk management lifecycle; governance elements (laws and regulations, frameworks, policies, standards and procedures); technical, administrative and physical controls; and professional conduct and the ISC2 Code of Ethics.
24% of the paper
Security Governance
Planning governance, risk and compliance; redundancy, business continuity and disaster recovery; security awareness; and measuring how effective the security programme is.
17% of the paper
Identity and Access Management
The identity life cycle (defining roles, provisioning, reviewing and deprovisioning access) and logical access controls: least privilege, separation of duties, and the discretionary, mandatory, role-based and attribute-based models.
20% of the paper
Networking and Cloud Security
Networking concepts, ports and protocols, firewalls, wireless and embedded systems; network security architecture (segmentation, defence in depth, Zero Trust); and cloud characteristics, service and deployment models, and the shared security model.
21% of the paper
Security Operations and Incident Response
Data security (encryption, hashing, classification, retention and destruction), security operations, incident response, asset protection and security testing.
18% of the paper

How to prepare

Take the free official ISC2 self-paced course if it is still offered; the exam is written to it.
Learn the definitions precisely. This exam distinguishes between similar terms (threat versus vulnerability versus risk, authentication versus authorisation, BCP versus DRP) and expects the textbook meaning.
Read the ISC2 code of ethics; it is examinable and often surprises candidates.
Do not over-invest in technical depth: there is no subnetting or configuration. Breadth and vocabulary are what score.
Twenty to forty hours of study is typical. Two practice papers above 80% and you are ready.

Sample questions

Three questions in the exam’s style, written by Square 1 against the published domains. They are ours, not the vendor's. The answer and the reasoning are under each one; the practice papers on this page draw from a bank written the same way, with an explanation on every question.

Question 1 · Security Principles
Which term describes the likelihood that a threat will exploit a vulnerability, combined with the resulting impact?
1. Threat
2. Vulnerability
3. Risk
4. Exposure
Answer: C. Risk is the combination of likelihood and impact. A threat is what could cause harm, a vulnerability is the weakness it could exploit, and exposure describes the extent of what is at stake.
Question 2 · Identity and Access Management
An organisation requires that the person who approves a payment cannot be the same person who creates it. Which principle is being applied?
1. Least privilege
2. Separation of duties
3. Defence in depth
4. Need to know
Answer: B. Separation of duties divides a sensitive process between people so no one person can complete it alone, which deters fraud and error. Least privilege and need to know limit access; defence in depth layers controls.
Question 3 · Security Governance
Which plan focuses specifically on restoring IT systems and data after a major disruption?
1. Business continuity plan
2. Disaster recovery plan
3. Incident response plan
4. Acceptable use policy
Answer: B. The disaster recovery plan is the technical plan for restoring systems and data. The business continuity plan keeps the business operating during a disruption, and the incident response plan handles security incidents as they occur.

Questions people ask before they book

Is the CC a good first certification?: Yes. It is the most accessible recognised security credential, it carries the ISC2 name, and it costs little or nothing to attempt. It will not replace Security+ where an employer specifies that, but it is a strong first line on a CV.
Is it free?: ISC2 has offered the training and a first exam attempt free under its One Million Certified in Cybersecurity programme; check the current terms. Holders pay an annual maintenance fee.
How hard is it?: Approachable. It is definitional and conceptual, with no simulations. Three to six weeks of part-time study is typical.
CC or Security+?: CC to start from zero at low cost; Security+ when a job advert or a compliance framework names it. Many people take CC first and Security+ within the year.
How long is it valid?: Three years, maintained with continuing professional education credits and the annual fee.